July 8, 2008 08:19pm pdt

1. RobWill 10,793
2. batry_boy 7,375
3. rsivanandan 5,260
4. Cyclops3590 4,000
4. grblades 4,000
6. younghv 3,875
7. alwayssm... 3,127
8. dpk_wal 2,500
9. briancassin 2,000
9. tjd01 2,000
9. bdeterding 2,000
9. paulop1975 2,000
9. ngravatt 2,000
9. fifthele... 2,000
9. toniur 2,000
9. GaryStevens 2,000
9. rokov 2,000
9. Jeff_Rod... 2,000
9. jahboite 2,000
9. PowerIT 2,000
9. aleghart 2,000
9. astaec 2,000
9. bansidhar 2,000
9. cshepfam 2,000
9. ShineOn 2,000
9. war1 2,000
9. PsiCop 2,000
9. murgroup 2,000
9. from_exp 2,000
9. pcfreaker 2,000
9. abedair 2,000
9. NeOXinHuH 2,000
9. aholtzmann 2,000
9. authen-tech 2,000

1. lrmoore 289,193
2. keith_al... 87,691
3. Sheharya... 83,045
4. tim_holman 82,777
5. srikrishnak 67,343
6. rsivanandan 60,887
7. RobWill 60,707
8. grblades 52,545
9. stevenlewis 46,723
10. PeteLong 46,200
11. war1 43,765
12. Tolomir 36,790
13. richrumble 36,263
14. harbor235 30,795
15. calvinetter 28,920

05.12.2008 at 11:15AM PDT, ID: 23395422

	[x] Attachment Details

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

7.4

Connectivity Problems

Zones: Windows XP Operating System, Desktop Anti-Virus, Consumer Firewalls

Tags: Microsoft, Windows XP, Home SP2

Hi All,
I'm a computer technician with a problem on a customer's computer.

The computer is running Windows XP Home SP2 on a network with no DHCP server. The computer is statically mapped and has a true internet address. All settings: IP, Subnet Mask, Gateway, and DNS servers are set correctly. Windows Firewall is turned off and all other firewall/antivirus programs have been uninstalled.

The scenario is this: After a recent antivirus software upgrade the computer has experienced connectivity "problems". I have since removed the antivirus software (trend micro 2008 internet security) and a cisco VPN client in my attempt to remedy the issue.

Primary symptoms: Computer appears to have something in it which is blocking ports. For example, I cannot ping the computer [from my laptop], it does not respond. Also, when using the computer, I cannot pull up any web sites. [cannot display page error]. Yet, if I ping www.google.com, I get a response [dns & connectivity is working]. If I try to pull-up a site using HTTPS, it works! It's like port 80 is blocked. In addition, the computer is a VNC server and I can no longer connect to it. If I boot up in SAFE mode, the computer can connect to web sites just fine and I can ping the computer successfully [from my laptop]. Yet, if a run MSCONFIG and turn EVERYTHING OFF and run a diagnostic startup [load basic services and drivers only] everything is blocked again. I've run hijack this, process explorer, winsock repair, and looked at netstat all to no avail...

It's like there is something in there blocking ports but I can't find it. Anyone have any suggestions?

Much appreciated.

--Rick

Start your free trial to view this solution

Question Stats

Zone: Security

Question Asked By: RangerRick1

Solution Provided By: RangerRick1

Participating Experts: 2

Solution Grade: A

Translate:

Loading Advertisement...

Microsoft

Internet Protocols
Applications

Development
OS

Hardware
Windows Security

Apple

Operating Systems
Hardware

Programming
Networking

Software

Internet

Search Engines
File Sharing
WebTrends / Stats
Spy / Ad Blockers

Web Browsers
New Net Users
Web Development
Chat / IM

Anti Spam
Web Servers
Anti-Virus
Email Clients

Gamers

Tips
Online / MMORPG
Puzzle
Emulators

Action / Adventure
Role Playing
Consoles
Game Programming

Strategy
Sports
Misc
Computer Games

Digital Living

Hardware
New Net Users
New Users

Software
Digital Music
Gaming World

Home Security
Apple
Networking Hardware

Virus & Spyware

Vulnerabilities
IDS
Encryption
Anti-Virus

Operating Systems Security
Software Firewalls
WebApplications
Cell Phones

Operating Systems
Internet
Hardware Firewalls

Hardware

Handhelds / PDAs
Displays / Monitors
Components
Networking Hardware

Peripherals
Laptops/Notebooks
Storage
Servers

Desktops
New Users
Misc
Apple

Software

System Utilities
Industry Specific
Network Management
Photos / Graphics
Page Layout
VMWare
Misc
Web Development

OS
CYGWIN
Voice Recognition
Message Queue
Quality Assurance
Security
Firewalls
MultiMedia Applications

Development
Database
Office / Productivity
Business Management
OS/2 Apps
Server Software
Internet / Email

ITPro

OS
Storage
Encryption
Operating Systems Security
Apple Hardware
Laptops & Notebooks
Servers
Networking Hardware
Peripherals

Devices
Displays / Monitors
WebTrends / Stats
Search Engines
Firewalls
WebApplications
IDS
Vulnerabilities
Email Clients

File Sharing
Spy / Ad Blockers
Web Browsers
Web Servers
Networking
Anti-Virus
Chat / IM
Anti Spam

Developer

Web Servers
Web Browsers
Game Programming
Dev Tools
Industry Specific
Office / Productivity

Database
CYGWIN
Web Development
Search Engines
File Sharing
WebTrends / Stats

Programming
Content Management
Application Servers
Protocols

Storage

Removable Backup Media
Storage Technology
Servers

Grid
Remote Access
Backup / Restore

Misc
Hard Drives

Miscellaneous
Security
Development
Linux
VMWare

MainFrame OS
Unix
Apple
OS / 2
AS / 400

BeOS
Microsoft
VMS / OpenVMS

Database

Oracle
Miscellaneous
MySQL
Software
Sybase
Contact Management
PostgreSQL
Data Manipulation
Clarion
InterSystems Cache

Siebel
MUMPS
OLAP
SQLBase
SAS
GIS & GPS
4GL
Berkeley DB
DB2
Informix

Interbase / Firebird
FoxPro
Reporting
LDAP
Filemaker Pro
MS SQL Server
dBase
MS Access

Security

Misc
Web Browsers
Software Firewalls
Operating Systems Security
File Sharing

Spy / Ad Blockers
Vulnerabilities
WebApplications
IDS
Anti-Virus

Encryption
Anti Spam
Email Clients
VPN
Chat / IM

Programming

Editors IDEs
Installation
Handhelds / PDAs
Multimedia Programming
System / Kernel

Algorithms
Game
Signal Processing
Project Management
Open Source

Database
Misc
Languages
Processor Platforms
Theory

Web Development

Scripting
Blogs
Web Servers
Software
Search Engines
Web Graphics
Images

Internet Marketing
Images and Photos
Components
Document Imaging
Web Languages/Standards
Illustration
WebApplications

Fonts
WebTrends / Stats
Authoring
Digital Camera Software
Miscellaneous

Networking

Protocols
Apple Networking
Network Management
Message Queue
Application Servers
Content Management
File Servers
Email Servers
Misc
Java Editors & IDEs

Wireless
Networking Hardware
Backup / Restore
System Utilities
ISPs & Hosting
Web Servers
Storage Technology
Removable Backup Media
Servers
Broadband

Grid
OS / 2
Novell Netware
Unix Networking
Windows Networking
Security
Telecommunications
Operating Systems
Linux Networking

Other

Community Advisor
Lounge
Community Support
New Net Users

Philosophy / Religion
Math / Science
Miscellaneous
URLs

Expert Lounge
Politics
Puzzles / Riddles

Community Support

Suggestions
New to EE
New Topics
Community Advisor

CleanUp
Announcements
General

Feedback
Input
EE Bugs

05.12.2008 at 11:20AM PDT, ID: 21549310

wildstar10:

actually its probably not your ports but your tcp/ip stack itself. to reinstall tcp/ip follow the steps on this page.
http://windowsxp.mvps.org/winsock.htm

-wild

05.12.2008 at 11:39AM PDT, ID: 21549449

RangerRick1:

I have already run the windows xp fix (winsock repair) as well as LSPfix. No luck...

> I've run hijack this, process explorer, winsock repair, and looked at netstat all to no avail... [nothing appears wrong]

05.13.2008 at 05:32AM PDT, ID: 21554335

wildstar10:

ok lets start going thru things then till we find it. Pls post your hijack this log and results of lspfix (which protocols are actually there. as well as a list of non microsoft services that are running. Also pls post the contents of your hosts file.

05.13.2008 at 06:11AM PDT, ID: 21554658

RangerRick1:

Wildstar - I worked on it all last night. I removed the hard drive and slaved it into another computer and ran several virus/spyware scans.

It is the ZLOB virus or one of its downloaded variants... I'll be cleaning it up later today.

Thanks for responding but I think we know what to do now!

Accepted Solution

05.13.2008 at 07:20AM PDT, ID: 21555278

wildstar10:

alrighty good luck witht he cleanup

05.23.2008 at 02:51PM PDT, ID: 21636078

Rank: Guru

moh10ly:

Following ...

05.23.2008 at 06:05PM PDT, ID: 21637164

Vee_Mod:

moh10ly - please do not post in any question that is in the 'self-close' mode.

All Concerned (Asker and Experts),

New Feature Alert!

Please do not make any post of any kind after a "Closing Request" has been started by the asker - unless you have a specific objection.

Any post by anyone will stop the automated process and force the manual intervention of a Moderator/Admin.

If anyone has questions about the process, please post them at the "Link to CS-G post:" below my signature.

RangerRick1 - Please start the process again and thank you for using it. When we all get used to the process, it will greatly improve the 'abandoned' question problem.

NOTE: If you have specific responses or posts you need to make, please do so before starting the process again.

Further details on this process are available at: http://www.experts-exchange.com/Community_Support/Announcements/Q_23151688.html

Vee_Mod
Experts Exchange Moderator
Link to CS-G post:
http://www.experts-exchange.com/Q_23429051.html

05.23.2008 at 06:08PM PDT, ID: 21637173

Vee_Mod:

RangerRick1,
Depending on the severity/type of infection, you will not be able to clean up the problem with just AV/AS scans (even in slaved mode).

There are a variety of tools for you to use - starting with the HijackThis (with log) that was mentioned above.

Vee_Mod
Experts Exchange Moderator

05.23.2008 at 07:07PM PDT, ID: 21637371

RangerRick1:

UPDATE: Indeed, normal AV/AS scans detected hundreds of hits but failed to remove the "root" virus [even in safe mode]. In addition, several published "manual removal methods" also failed to successfully remove the virus.

The infection was so severe, the client actually requested to reformat and re-install the O/S. I got the "water travelling down hill--course of last resistance" speech. I've always considered a re-install to be undesirable [a kind of failure], but the client was insistent.

In this case, the PC had only a basic windows install, microsoft office, and an email account in outlook to setup. We simply backed up the PST file, reformatted the hard drive, and re-installed Windows and ms office. Setting up outlook and importing in the old PST information only took a few minutes of tech time ... so the re-install was probably the "easier/faster" choice.

This Zlob virus [and its many variants] are nasty!

20080236-EE-VQP-29 / EE_QW_2_20070628